Skip to content

Conversation

@valentijnscholten
Copy link
Member

Pro uses a custom implementation for hashing as it stores its settings differently and has some extra hash_code fields. The reimporter was not using this when calculating hashes, causing deduplication to fail for findings that are created during a reimport.

@valentijnscholten valentijnscholten added this to the 2.53.0 milestone Nov 11, 2025
@valentijnscholten valentijnscholten added Pro affects_pro PRs that affect Pro and need a coordinated release/merge moment. and removed Pro labels Nov 11, 2025
@valentijnscholten valentijnscholten force-pushed the pro-hash-code-reimport-fix branch from 00c313e to e3f7546 Compare November 12, 2025 14:37
@valentijnscholten valentijnscholten changed the title reimport: support pro hash method reimport: support pro compute hash code method Nov 12, 2025
@valentijnscholten valentijnscholten modified the milestones: 2.53.0, 2.52.2 Nov 12, 2025
@valentijnscholten valentijnscholten force-pushed the pro-hash-code-reimport-fix branch from 110ef68 to b206f52 Compare November 12, 2025 19:13
@dryrunsecurity
Copy link

DryRun Security

🔴 Risk threshold exceeded.

This pull request modifies sensitive files (dojo/importers/default_reimporter.py and dojo/models.py), triggering configured codepath alerts for potentially sensitive edits; review and verify these changes and allowed authors as configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py
Vulnerability Configured Codepaths Edit
Description Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.
🔴 Configured Codepaths Edit in dojo/models.py
Vulnerability Configured Codepaths Edit
Description Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

We've notified @mtesauro.


All finding details can be found in the DryRun Security Dashboard.

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@Maffooch Maffooch merged commit ed83097 into DefectDojo:bugfix Nov 13, 2025
150 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

affects_pro PRs that affect Pro and need a coordinated release/merge moment.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants